NVD

Id
36622  
Name
CVE-2013-0269  
Description
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-02-12  
Modified Date
2016-12-07  
Seq
2013-0269  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
187149 36622 CVE-2013-0269 APPLE-SA-2013-10-22-5  View
187150 36622 CVE-2013-0269 SUSE-SU-2013:0609  View
187151 36622 CVE-2013-0269 SUSE-SU-2013:0647  View
187152 36622 CVE-2013-0269 openSUSE-SU-2013:0603  View
187153 36622 CVE-2013-0269 RHSA-2013:0686  View
187154 36622 CVE-2013-0269 RHSA-2013:0701  View
187155 36622 CVE-2013-0269 RHSA-2013:1028  View
187156 36622 CVE-2013-0269 RHSA-2013:1147  View
187157 36622 CVE-2013-0269 http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed  View
187158 36622 CVE-2013-0269 http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/  View
187159 36622 CVE-2013-0269 [oss-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]  View
187160 36622 CVE-2013-0269 [oss-security] 20130211 Patch update for [CVE-2013-0269]  View
187161 36622 CVE-2013-0269 57899  View
187162 36622 CVE-2013-0269 SSA:2013-075-01  View
187163 36622 CVE-2013-0269 USN-1733-1  View
187164 36622 CVE-2013-0269 http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection  View
187165 36622 CVE-2013-0269 json-ruby-security-bypass(82010)  View
187166 36622 CVE-2013-0269 [rubyonrails-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19991 JVNDB-2013-001566 JSON gem におけるサービス運用妨害 (リソース消費) の脆弱性 JSON gem には、サービス運用妨害 (リソース消費) 状態となる、またはマスアサインメント防御メカニズム (mass assignment protection mechanism) を回避される脆弱性が存在します。 CVE-2013-0269 60211 CVE-2013-0269 36622 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001566.html 2013-02-11 2015-08-11 View